templates: anchor the osv-scan pin to v0.1.0 — a # main comment makes a SHA pin invisible to Dependabot - #25
Merged
Conversation
…es a SHA pin invisible to Dependabot The fourth and final link in the convergence chain, found by inspecting Dependabot's first fleet run rather than assuming it worked. The 44 group PRs it opened bump checkout, harden-runner, codeql — and mint's reusable workflows from @v0.3.1 to @v0.5.0 — while leaving every osv-scan pin untouched, tag or no tag. The difference is the comment. Dependabot establishes what version a SHA-pinned uses: currently IS from its trailing tag comment; '# main' names a branch, which gives it no version ordering to reason from, so the pin is skipped even now that release tags exist. mint's refs are tag-anchored and bumped cleanly in the same PRs -- the mechanism works, these pins were just invisible to it. So the template now pins @07cab52 # v0.1.0 (the tag's commit; a verified descendant of 162accb), and the fleet needs ONE lift onto that shape -- after which Dependabot maintains it tag-to-tag like it already does for mint. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017RMKHpGXzw9Zkv49fzVssg
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The fourth link in the convergence chain, found the same way as the third — by inspecting what Dependabot actually did rather than assuming.
What the first fleet run showed
Dependabot fired immediately on the config merges: 44 grouped
ci:PRs across the fleet, within minutes. They bumpcheckout,harden-runner,codeql— and, tellingly, mint's reusable workflows from@v0.3.1to@v0.5.0— while leaving every osv-scan pin untouched, on repos at8b7d8a8and62990ddalike, withv0.1.0minted and visible.Why
Dependabot establishes what version a SHA-pinned
uses:currently is from its trailing tag comment. Every caller's comment reads# main— a branch, which gives it no version ordering to reason from — so the pin is skipped entirely, tags or no tags. mint's refs are tag-anchored and bumped cleanly in the same PRs: the mechanism works; these pins were invisible to it.The fix
Template now pins
@07cab52 # v0.1.0— the tag's commit, a verified descendant of162accb(merge-base --is-ancestorchecked), with the comment block rewritten to say the tag comment is load-bearing, not decoration.The fleet needs one lift onto this shape —
@07cab52 # v0.1.0per caller — after which Dependabot maintains it tag-to-tag, as it demonstrably already does for mint. That lift is the actual re-pin sweep, and unlike the previous understanding, it's the last manual one: every future template bump propagates viarelease-tag.yml→ Dependabot → grouped PR.Known follow-ups, not in this PR
sedone line each — same recipe as tonight's fan-out).caller-pins.pyclassifies a caller ahead of the template pin asahead-or-diverged; once Dependabot moves callers to tags the template hasn't re-pinned to yet, that state becomes routine and the classifier should treat descendant-of-template as acceptable.🤖 Generated with Claude Code
https://claude.ai/code/session_017RMKHpGXzw9Zkv49fzVssg
Generated by Claude Code